this post was submitted on 23 Sep 2023
874 points (97.8% liked)

Memes

45680 readers
710 users here now

Rules:

  1. Be civil and nice.
  2. Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.

founded 5 years ago
MODERATORS
gary_host_laptop@lemmy.ml
sexy_peach@feddit.de
cyclohexane@lemmy.ml
cypherpunks@lemmy.ml
874
I will burn your servers to the ground, foul villain (startrek.website)
submitted 1 year ago by Stamets@startrek.website to c/memes@lemmy.ml
55 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] Enekk@lemmy.world 7 points 1 year ago* (last edited 1 year ago)

The attack vector is as follows:

  1. Evil.com phishes a user and asks for username and password for Good.com
  2. Evil.com immediately relays those credentials to Good.com
  3. Good.com asks Evil.com for TOTP
  4. Evil.com asks victim for TOTP
  5. Evil.com relays TOTP to Good.com and does a complete account takeover

The various physical dongles prevent this by using the asking domain as part of the hash. If you activated the dongle on Evil.com, it'll do nothing on Good.com (except hopefully alerting the SOC at Good.com about a compromised username and password pair).